The present invention relates to an electrically controlled, decentralized control system in a vehicle, e.g., a braking system.
For such control systems, which generally are not equipped with a mechanical, hydraulic or pneumatic backup system, special attention must be given to availability, even in the case of a fault. An example of an electrically controlled, decentralized braking system which satisfactorily meets the demands made is described in German Patent No. 196 34 567 (Great Britain No. GB-2 316 726). This known braking system for a motor vehicle (brake-by-wire) has a decentralized design and possesses a control module for ascertaining the driver""s braking input (desire) and control modules for adjusting the braking force at the individual vehicle wheels; in one preferred exemplary embodiment, such a control module actuates a group of wheel brakes (combined axle-wise or diagonally). To connect the control module ascertaining the driver""s input to the control modules for adjusting the braking force, at least one communication system is provided on which the control modules exchange data among themselves. In order to ensure at least partial operability of the braking system in the case of a fault, further independent communication connections are provided between the control module for ascertaining the driver""s input and the control modules for adjusting the braking force. The signals from several (two or three) sensors which detect the actuation of the brake pedal by the driver are supplied to the control module for ascertaining the driver""s input. In the control module, these sensor signal values are checked for correctness by at least two computer units which are independent of one another, and in each case a value is determined for the driver""s braking input which is then checked for correctness by the respective other computer unit. The resulting error-free driver""s input value, optionally corrected axle-individually or wheel-individually as a function of further quantities such as axle load or of functions such as a vehicle dynamics control, is then transmitted via the communication system to the individual control modules for adjusting the braking force.
Because of the separate modules, each equipped with at least two computer units, the known electrically controlled, decentralized control system has a relatively high expenditure.
An object of the present invention is to provide measures which make it possible to reduce the expenditure for an electrically controlled, decentralized control system, without endangering the availability and performance reliability of the control system. German Patent Application No. 198 26 131.4, not pre-published, describes constructing control modules as so-called fail-operational units which continue to be functional in the event of a single fault. Such control modules are designed to be fault-tolerant, e.g., by implementation with the aid of a redundant microcomputer system composed of at least two microcomputers and a monitoring component. The microcomputers and the monitoring component communicate via the internal communication channel which is realized, for example, by a serial bus system or with serial interfaces. Implemented within the microcomputer system for carrying out the control tasks are at least two independent programs which reciprocally check their results. In this way, the module remains fully functional in the event of an individual fault.
By the direct feeding of in each case one actuating signal of an operating control element, e.g. of a brake pedal, to control modules which control at least one selected control element (e.g., a wheel brake)xe2x80x94at least two different actuating signals being providedxe2x80x94the costly control module for ascertaining the driver""s input is dispensed with and the expenditure for an electrically controlled, decentralized control system is considerably reduced.
The mutual exchange of the actuating signals between the control modules, that is to say, the exchange of partial results between these modules with respect to the driver""s input, this exchange being via a communication system connecting these units, ensures the availability of the driver""s input ascertainment even if one of the sensors for detecting an actuating signal malfunctions, so that there is no need to fear any restrictions vis-a-vis the related art with respect to the availability of the control system.
It is particularly advantageous if the communication system connecting the modules is a time-controlled communication system, e.g., a so-called TTP/C bus. This permits simultaneous acquisition of the actuating signals in the individual modules, since a synchronous system time is available.
A special advantage is that at least one actuating signal, from which the actuation of the operating control element is derivable, is available in each control module, even if the communication system malfunctions. This yields an at least partial availability of the braking system, even in the event of a failure of the communication system.
Particularly advantageous is that the electrically controlled braking system formed in this manner is usable in conjunction with all electrically controlled brake actuators, e.g., with electrohydraulic brake actuators, electropneumatic, electromagnetic or electromotive actuators.